CVE-2026-20125
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2026-20125 is a high-severity Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerability in Cisco IOS Software (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20125 is a vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E. The issue arises from improper validation of user-supplied input, which could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. Published on 2026-03-25, the vulnerability carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) and maps to CWE-228.
An attacker can exploit this vulnerability by sending malformed HTTP requests to an affected device, provided they possess a valid user account. Successful exploitation triggers a watchdog timer expiration, forcing the device to reload and disrupting network services in a DoS scenario. The low complexity and privileges required (local authenticated access) combined with network accessibility make it feasible for targeted attacks.
Details on mitigation, workarounds, and patches are available in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-http-dos-sbv8XRpL.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15449
Vulnerability Data
A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.…
more
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malformed HTTP requests to an affected device. A successful exploit could allow the attacker to cause a watchdog timer to expire and the device to reload, resulting in a DoS condition. To exploit this vulnerability, the attacker must have a valid user account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validity checks on information inputs, directly stopping syntactically malformed data from being processed without proper handling.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require robust input validation and syntax handling to prevent malformed-structure flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect malformed-input issues but does not itself implement the handling logic.
Secure development life cycle mandates input validation and error handling that directly prevents improper handling of syntactically invalid structures.
Application security requirements include explicit rules for input validation and malformed-data handling.
Secure system architecture principles encourage robust input handling but do not prescribe the specific coding practice.
Secure coding explicitly requires validation of all input syntax and structure, directly eliminating CWE-228.